Reconciles the upstream audit-fix PR's infra changes onto the Veect
control-plane fork (kept-file portions only; deleted demo features
skipped):
- resolve the root playwright config in pnpm test:visual (S8)
- prune dead VERCEL_ENV from turbo.json globalEnv (S9)
- drop the duplicate chromium install in the storybook CI job (S10)
- wire scripts/**/*.test.mjs under a dedicated vitest runner
(vitest.scripts.config.mjs + pnpm test:scripts + CI validate step);
convert node:test imports to vitest keeping node:assert; fix the
work-tree fixtures to mirror the docs/work/epics/ layout
- ignore *.tsbuildinfo repo-wide and untrack the committed build state
- align every @trpc/* range on ^11.18.0 so the workspace resolves to a
single version (peer-warning-free install)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
Workspaces Payload collection with the PAT as a write-only field:
access.read () => false strips it from every access-controlled read
path, and a field-level beforeChange hook encrypts on write with
AES-256-GCM (scrypt key from VEECT_SECRET, random per-value salt + IV,
v1 storage format) via node:crypto only. The real repository replaces
the phase-1 stub with payload create/findByID; toDomain never maps the
credential, and getDecryptedCredential(id) is the single server-side
decrypt path for the runner handoff (story 07). Contract suite now
covers create, write-only behaviour, and the decrypt path against both
the mock and the Payload impl (stub runs the real collection hooks).
Missing VEECT_SECRET fails production bind/boot with an actionable
message; dev-seed boots without it. Env declared in turbo.json
globalEnv + .env.example.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
Veect retrofit (ADR-027): the product is a hosted SaaS built on
web-next; apps/web-tanstack existed only as template demo surface for
the TanStack Start framework path. This slice removes the app and all
wiring that referenced it:
- turbo.json globalEnv: WEB_TANSTACK_SENTRY_DSN,
VITE_WEB_TANSTACK_SENTRY_DSN, VITE_GIT_COMMIT_SHA,
SENTRY_PROJECT_WEB_TANSTACK
- .env.example: the same four DSN/release vars
- generator e2e fixtures that stripped deps from the app's package.json
- coverage diff comment + test fixtures referencing apps/web-tanstack
- app-list entries in README, CLAUDE.md (port table, Sentry projects),
AGENTS.md (tags, binder list, per-app docs), docs/glossary.md (App)
- pnpm-lock.yaml importer + orphaned transitive deps
Framework-support code in core packages stays: core-trpc's TanStack
provider, core-shared security/tanstack middleware, and the Sentry
react/node init adapters are generic TanStack support, not app wiring.
Prose in guides/ADRs/library traces is story 08 scope.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
